Your Site Is Hosting Someone Else’s Fake Login Page
The first sign is often an email you did not expect. Your host writes to say it has received an abuse complaint. Your domain registrar warns that the domain may be suspended. A bank, a delivery company or a software brand you have nothing to do with has reported a page on your site as a phishing attempt. You open the link they quote and find a perfect copy of a login screen, sitting in a folder on your website that you never created.
Phishing pages are among the most damaging things an attacker can put on a hacked site, because they hurt people who have never heard of you. Visitors who land there are tricked into typing passwords or card details, and your domain is the one blamed for it. How we respond to a compromised site in general is set out on the hacked website repair page. This page is about the specific job of finding and removing phishing kits, answering the takedown notices, and getting your domain’s reputation back.
How Phishing Ends Up on a Legitimate Website
People who run phishing campaigns prefer to use other people’s websites. A real business domain, with a real history and an SSL certificate, is less likely to be blocked by email filters than a brand-new domain registered that morning. So they break into ordinary sites and use them as hosting they never pay for.
What they upload is usually called a phishing kit: a ready-made bundle, often a single zip file, that unpacks into a folder of pages imitating a well-known login. Common targets include online banking, email and office suites, payment services, parcel delivery notices and streaming accounts. The kit collects whatever the victim types and sends it on to the attacker, commonly by email or through a messaging service.
The ways in are the same as for other hacks: an outdated plugin, a stolen hosting or FTP password, or an old, forgotten install in a subfolder. What makes phishing different is where the files end up. They are often placed deep in the uploads folder, inside a plugin directory, or in a folder named to look harmless, such as something resembling a system or verification path. The rest of your site keeps working normally, which is why owners rarely spot it themselves.
Why This Needs Fast, Careful Action
A phishing complaint starts a chain of consequences that can spread well beyond the one page:
- Your host may suspend the account. Hosts take phishing reports seriously, and many will disable the whole account rather than one folder. Where the account is already offline, getting a suspended hosting account back is its own job, set out on a separate page.
- Your registrar may act on the domain. Registrars can receive abuse reports too, and some will place a hold on a domain that keeps hosting phishing.
- Browsers may block the site. Google Safe Browsing flags phishing pages, and Chrome and other browsers then show a red “Deceptive site ahead” screen to visitors. A separate post explains that red deceptive-site screen and why browsers show it.
- Your email may suffer. If your domain becomes associated with phishing, messages you send from it can start landing in spam folders.
The goal is to remove the kit, and any way back in, before those consequences pile up, and then to show the people who complained that it has been dealt with.
How We Remove Phishing Pages
Start from the abuse notice
The notice usually names the exact URL that was reported. That is our first lead, but rarely the only page. Kits often come in several copies, placed in different folders so that removing one leaves the others running. We use the reported path to find the upload date and then look for every other file added around the same time.
Back up before removing
We copy the site, kit included, before deleting anything. The kit itself can show which brand was being imitated and where stolen details were being sent, which is useful if you decide to report it, and it keeps a record of what was found should the host or registrar ask.
Remove the kit and its leftovers
We delete the phishing folders, any zip archives they were unpacked from, and any redirect rules that send visitors from innocent-looking links to the fake page. We also check the server’s configuration files in those folders, because attackers sometimes add rules that hide the kit from the site owner while showing it to visitors who arrive from a phishing email.
Find the uploader
Someone, or something, put those files there. We look for the script that did it: a file manager disguised as a plugin, a small upload form hidden in a theme file, or PHP files in places where only images should be. Our blog post on PHP files in the WordPress uploads folder explains why those are such a strong warning sign. Removing the uploader is what stops a fresh kit arriving the next day, and where it is part of a wider infection, the work continues as a full WordPress malware cleanup.
Close the way in and reset access
We update or remove the vulnerable software, change hosting, FTP and database passwords, and check for other sites on the same hosting account. Phishing operators like accounts with several sites because one break-in gives them many folders to use.
Answering the Takedown Notice
Removing the files is only half of it. The host or registrar that wrote to you needs to hear back, and a clear reply makes it more likely they will close the ticket rather than escalate.
A useful reply is short and factual. It confirms the reported URL now returns a “not found” response, says which files were removed, explains what was done to stop it returning, and gives a contact for follow-up questions. We draft that reply with you and can send it on your behalf if you prefer. We do not pretend to be your host or registrar, and we cannot promise how quickly they will respond, but we make sure what they receive gives them what they need.
If Google has flagged the site, Search Console’s Security Issues report will list the problem. After the cleanup, a review is requested from that report. Our Google blacklist removal service covers that request, and our blog post on reading the Search Console Security Issues report explains what each part of it means. Some security vendors and antivirus products keep their own lists; if your site is blocked by one of those, see website flagged by antivirus.
What You Should Do Right Now
- Do not ignore the abuse email. Reply to say you have seen it and are dealing with it. Silence is often what leads to a suspension.
- Do not visit the phishing page and type anything into it. Treat it as live. Opening it is usually harmless, but there is no reason to test the form.
- Save the notice. Keep the full email, including the reported URL and any reference number. We will need both.
- Change your hosting control panel password from a clean device. This blocks one of the most common routes the uploader used.
- Warn your own team. If phishing emails were sent using your domain’s reputation, customers might ask about them. Tell staff that the site was misused and that the business never asks for passwords by email.
When You Find the Kit Before Anyone Complains
Sometimes the owner spots the folder first, often while looking at disk usage or during a scan. That is the best case. Removing it before reports start means there is no ticket to answer and no flag to clear. The same rule still applies, though: a kit you found means an uploader you have not found yet. Delete the folder by all means, but treat the site as compromised until the entry point is closed.
Getting Help With a Phishing Complaint
A phishing complaint is urgent work, and it is placed ahead of routine jobs. WhatsApp is quickest: begin your message with the word HACKED and paste or forward the abuse notice. Calling or using the contact form also works.
We review the reported URLs, give you an honest view of the situation and a likely start, and save a full copy of the site before a single file is deleted. You will get updates on WhatsApp as the kit is removed, the uploader is found and the reply to your host is ready. If you are in the USA and the notice reached you late in your day, our team in India is often already working, which can mean the cleanup begins while you sleep.